From 19d4457ce7b5796338c8a286ab109a1c0c827479 Mon Sep 17 00:00:00 2001 From: 0x0d4y Date: Thu, 30 Oct 2025 14:14:56 -0300 Subject: [PATCH] Add ScoringMathTea API Hashing Algorithm --- algorithms/smt_api_hashing.py | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 algorithms/smt_api_hashing.py diff --git a/algorithms/smt_api_hashing.py b/algorithms/smt_api_hashing.py new file mode 100644 index 0000000..2aa801b --- /dev/null +++ b/algorithms/smt_api_hashing.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python +import ctypes + +DESCRIPTION = """ + + Author = 0x0d4y + + Description = This is the API Hashing algorithm, of ScoringMathTea RAT used by Lazarus. + + Sample_I MD5: cc9cf047aec871cefb1c7d4b8d5d3432 + +""" +TYPE = 'unsigned_int' +TEST_1 = 797271551 + +def hash(data): + h = 0x2DBB955 # Seed value + for char_byte in data: + if char_byte >= 128: + signed_char_val = char_byte - 256 + else: + signed_char_val = char_byte + + signed_h = ctypes.c_int32(h).value + + s = signed_h >> 2 + m = signed_h * 32 + right_side = (signed_char_val + s + m) + + h = (h ^ right_side) & 0xFFFFFFFF + + return h \ No newline at end of file